CVE-2026-16724

IBM Power Systems firmware running the Virtualization Management Interface (VMI) is vulnerable to CWE-190 integer overflow, classified CVSS 4.5 (Medium). Authenticated administrators can crash the VMI, which auto-restarts, but repeated exploitation could cause sustained availability impact. Affec...

CVE-2026-55085

Etherpad (real-time collaborative editor) is affected by a stored cross-site scripting vulnerability prior to version 3.3.1 . The root cause is in result.appendSpan in src/static/js/domline.ts, which interpolates the start attribute of a numbered list directly into an unquoted ol start attribute ...

CVE-2026-16832

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP management network protocol. An attacker with authenticated HMC administrator access can execute arbitrary code on the service...

CVE-2026-16832

The vulnerability is a CWE-121: Stack-based Buffer Overflow in the FSP management network protocol. An authenticated HMC administrator can execute arbitrary code on the service processor, achieving full system control (CWE-3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, score 8.4 HIGH). Affected firmwar...

EUVD-2026-62690

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP management network protocol. An attacker with authenticated HMC administrator access can execute arbitrary code on the service...

CVE-2026-16832 Power System Buffer Overflow

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP management network protocol. An attacker with authenticated HMC administrator access can execute arbitrary code on the service...

EUVD-2026-62683

IBM Server Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP firmware update process. An attacker with authenticated administrator-level access to the FSP can, under specific conditions, execute...

CVE-2026-70496

A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equivalent to a cluster administrator, allowing it to impersonate other entities, write Role-Based Access Control RBAC configurations, approve Certificate Signing Requests CSRs, and manage ManifestWork. This grants...

CVE-2026-18430

HumHub 1.18.4 contains a stored cross-site scripting vulnerability in the comment-deletion notification flow. A Space administrator can delete another user's comment, choose to notify the original author, and place HTML/JavaScript in the deletion reason...

EUVD-2026-62546

HumHub 1.18.4 contains a stored cross-site scripting vulnerability in the comment-deletion notification flow. A Space administrator can delete another user's comment, choose to notify the original author, and place HTML/JavaScript in the deletion reason...

CVE-2026-18430 HumHub 1.18.4 - Stored XSS in comment-deletion notifications through unescaped administrator reason

HumHub 1.18.4 contains a stored cross-site scripting vulnerability in the comment-deletion notification flow. A Space administrator can delete another user's comment, choose to notify the original author, and place HTML/JavaScript in the deletion reason...

CVE-2026-18430

HumHub 1.18.4's comment-deletion notification flow does not sanitize the administrator-supplied reason, allowing stored XSS when the original author views the notification. A Space admin can inject HTML/JavaScript targeting another user. CVSS 7.2 (HIGH) reflects network access with high privilege...

CVE-2026-18430 HumHub 1.18.4 - Stored XSS in comment-deletion notifications through unescaped administrator reason

HumHub 1.18.4 contains a stored cross-site scripting vulnerability in the comment-deletion notification flow. A Space administrator can delete another user's comment, choose to notify the original author, and place HTML/JavaScript in the deletion reason...

CVE-2026-75952

Joomla Extension - cmsjunkie.com - Cross-site request forgery in J-BusinessDirectory 6.2.3 - Tokens were missing on many AJAX/state-changing tasks: contact/quote forms, cart, bookmarks, uploads, messages, AI text generation, and several administrator actions app install, demo-data wipe,...

CVE-2026-75952 Joomla Extension - cmsjunkie.com - Cross-site request forgery in J-BusinessDirectory < 6.2.3

Joomla Extension - cmsjunkie.com - Cross-site request forgery in J-BusinessDirectory 6.2.3 - Tokens were missing on many AJAX/state-changing tasks: contact/quote forms, cart, bookmarks, uploads, messages, AI text generation, and several administrator actions app install, demo-data wipe,...

EUVD-2026-62501

Joomla Extension - cmsjunkie.com - Cross-site request forgery in J-BusinessDirectory 6.2.3 - Tokens were missing on many AJAX/state-changing tasks: contact/quote forms, cart, bookmarks, uploads, messages, AI text generation, and several administrator actions app install, demo-data wipe,...

CVE-2026-75952 Joomla Extension - cmsjunkie.com - Cross-site request forgery in J-BusinessDirectory < 6.2.3

Joomla Extension - cmsjunkie.com - Cross-site request forgery in J-BusinessDirectory 6.2.3 - Tokens were missing on many AJAX/state-changing tasks: contact/quote forms, cart, bookmarks, uploads, messages, AI text generation, and several administrator actions app install, demo-data wipe,...

CVE-2026-75952

J-BusinessDirectory (a Joomla extension by cmsjunkie.com) versions below 6.2.3 are affected by a cross-site request forgery (CSRF) vulnerability. The root cause is the absence of CSRF tokens on numerous AJAX and state-changing endpoints, including contact/quote forms, cart operations, bookmarks, ...

EUVD-2026-62486

MyBooks is an enhanced and easy-to-use personal ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler in webserver/handlers/admin.py accepts SOCIALAUTH key names without validating quotes or newline characters, and SettingsLoader.dumpfile in...

CVE-2026-76242

stigmem-node 0.9.0a1 accepted federation peer key material during peer registration without a separate administrator out-of-band fingerprint approval step. On nodes that accept federation peer registration over a network where initial registration can be intercepted or misdirected, an attacker ca...